CVE-2021-4435: Yarn untrusted search path vulnerability
Summary
CVE-2021-4435: Yarn untrusted search path vulnerability. Affects yarn versions < 1.22.13. Fixed in 1.22.13. How to fix ↓
Also tracked for
- node-yarnpkg · Debian:11
The same CVE-2021-4435 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a popular package manager for the npm ecosystem. It is used to manage dependencies and facilitate the installation of packages in JavaScript projects. Yarn provides a command-line interface (CLI) that allows developers to execute various commands for package management. However, a vulnerability has been discovered in Yarn that could allow for the execution of malicious commands when certain Yarn commands are run in a directory with attacker-controlled content.
Vulnerability Detail
The vulnerability in Yarn arises from an untrusted search path issue. When a victim runs specific Yarn commands in a directory that contains content controlled by an attacker, it is possible for malicious commands to be executed in unexpected ways. This can lead to various security risks, including the execution of arbitrary code, privilege escalation, and unauthorized access to sensitive information. The vulnerability has a CVSS v3 score of 7.7, indicating a high severity level.
How To Fix
Latest published version: 1.22.22 as of 22 Oct 2026
npm install yarn@1.22.22Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.22.13
This is the first release that contains the fix.
npm install yarn@1.22.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update Yarn to the latest version to mitigate the risk of exploitation.
Conclusion
In conclusion, the Yarn untrusted search path vulnerability poses a significant risk to projects that utilize Yarn for package management. It is crucial to update Yarn to the latest version (1.22.13 or later) to ensure the secure execution of Yarn commands and mitigate the potential security risks associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for yarn →
FAQ
Yarn is a package manager for the npm ecosystem, commonly used in JavaScript projects. It provides a CLI for managing dependencies and installing packages.
The vulnerability arises from an untrusted search path issue in Yarn. When certain Yarn commands are executed in a directory with attacker-controlled content, malicious commands can be executed unexpectedly.
The vulnerability can lead to the execution of arbitrary code, privilege escalation, and unauthorized access to sensitive information.
The vulnerability has a CVSS v3 score of 7.7, indicating a high severity level.
To fix this vulnerability, it is recommended to update Yarn to version 1.22.13 or later. This version includes a fix for the untrusted search path issue.
Related vulnerabilities
Recent vulnerabilities recorded for yarn.
